dmaengine: k3dma: fix potential deadlock on &d->lock

Commit Message

Chengfeng Ye June 27, 2023, 4:08 p.m. UTC

As &d->lock is acquired by the tasklet k3_dma_tasklet() under softirq
context, other process context code acquring the lock should disable
irq or at least bottom-half irq. The dma terminate callback
k3_dma_terminate_all() and pause callback k3_dma_transfer_pause()
acquire the same lock but without closing irq.

I am not sure whether the two callbacks are already irq close in the
core, if not, then it would have the following deadlocks. But I saw
a spin_lock_irq() or another lock inside the terminate callback so
I guess not.

Possible deadlock scenario:
k3_dma_transfer_pause()
    -> spin_lock(&d->lock)
        <tasklet interrupt>
        -> k3_dma_tasklet()
        -> spin_lock_irq(&d->lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_irqsave(),
or it can be spin_lock_bh() if should be fixed?

Signed-off-by: Chengfeng Ye <[e-mail]>
---
 drivers/dma/k3dma.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

Chengfeng Ye July 18, 2023, 8:12 a.m. UTC | #1

Dear Maintainers,

I hope this message finds you well.

The patch was submitted during last merged windows and
I think maybe it is buried under other patches. If you've had
a chance to look at it and have any feedback, I would be
very appreciative.

Best regards,
Chengfeng

Patch

diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index ecdaada95120..ee398cb4ac11 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -728,9 +728,9 @@  static int k3_dma_terminate_all(struct dma_chan *chan)
 	dev_dbg(d->slave.dev, "vchan %p: terminate all\n", &c->vc);
 
 	/* Prevent this channel being scheduled */
-	spin_lock(&d->lock);
+	spin_lock_irqsave(&d->lock, flags);
 	list_del_init(&c->node);
-	spin_unlock(&d->lock);
+	spin_unlock_irqrestore(&d->lock, flags);
 
 	/* Clear the tx descriptor lists */
 	spin_lock_irqsave(&c->vc.lock, flags);
@@ -764,6 +764,7 @@  static int k3_dma_transfer_pause(struct dma_chan *chan)
 	struct k3_dma_chan *c = to_k3_chan(chan);
 	struct k3_dma_dev *d = to_k3_dma(chan->device);
 	struct k3_dma_phy *p = c->phy;
+	unsigned long flags;
 
 	dev_dbg(d->slave.dev, "vchan %p: pause\n", &c->vc);
 	if (c->status == DMA_IN_PROGRESS) {
@@ -771,9 +772,9 @@  static int k3_dma_transfer_pause(struct dma_chan *chan)
 		if (p) {
 			k3_dma_pause_dma(p, false);
 		} else {
-			spin_lock(&d->lock);
+			spin_lock_irqsave(&d->lock, flags);
 			list_del_init(&c->node);
-			spin_unlock(&d->lock);
+			spin_unlock_irqrestore(&d->lock, flags);
 		}
 	}